macOS Gatekeeper Bypassed by App Swaps

Security researchers Talal Haj Bakry and Tommy Mysk have uncovered a notable vulnerability within the macOS security architecture. Their findings demonstrate that once an application downloaded from the internet has been executed for the first time, it can be replaced by a malicious version without triggering fresh security warnings from the operating system.

The Breakdown in Validation Logic

The core of the issue lies in how Apple's Gatekeeper handles application integrity. Typically, this system is designed to confirm that software originates from an identified developer and remains unaltered from its original state. However, the researchers discovered that by using the tar utility to archive and then restore an application bundle, they could overwrite the primary executable while bypassing subsequent integrity checks.

This suggests that macOS relies on a cached state of trust established during the first launch of a program. Once the system has marked the application as legitimate, it appears to retain this status even if the underlying code is modified, allowing a malicious replica to masquerade as the original, trusted software.

Execution and Attack Vectors

While the flaw is significant, it is not a zero-click exploit that can be triggered remotely. An attacker must first gain user-level code execution on the target machine. This prerequisite could be met through several common infection paths, including:

• Malicious scripts or applications installed via the command line.
• Social engineering tactics that trick users into running unauthorized terminal commands.
• Prompt injection attacks targeting AI agents.
• Supply chain compromises involving package managers like npm or brew.

Apple's Stance on the Findings

The Mysk team reported their observations to Apple, though the company ultimately chose to close the issue without implementing a fix. The researchers say they were informed that Apple does not view this behavior as a violation of the signed executable's integrity. Instead, the company categorized the process of archiving and restoring an app bundle as a form of local build generation.

When you open the app for the first time and it passes all validation checks, macOS marks the app as trusted and saves this data. Later when I modify the executable, macOS detects a change in the bundle and tries to revalidate its integrity. It seems the cached value of the trust causes macOS to pass the validation even though the bundle has changed.

— Tommy Mysk, security researcher

Implications for System Security

This situation highlights a disconnect between researcher expectations and the manufacturer's security model. Because Apple considers the resulting app bundle to be locally built, it falls outside the standard protections typically afforded to notarized software. For end users, this means that even legitimate applications like Signal, Brave, or Visual Studio Code could potentially be replaced by malicious doppelgangers that inherit the reputation and permissions of the original app. While these altered versions may still trigger standard authorization prompts for sensitive resources like the Keychain or TCC-protected directories, the initial trust established by Gatekeeper could lead users to interact with such prompts more readily, thinking the request originates from a known and verified source.